Six steps for successful incident investigation

Organisations investigate business upsets because they are required to by law or their own company standards, or the public or shareholders expect it. But, whatever the motivation, the goal is to identify why the incident happened and to take action to reduce the risk of future incidents.

Investigations often find that similar scenarios have occurred previously but, for a variety of reasons, did not result in serious consequences. This is increasingly recognised in high-risk industries where “near misses” are also investigated as well as incidents which actually resulted in loss.

A six-step, structured approach to incident investigation (Fig 1) helps to ensure that all the causes are uncovered and addressed by appropriate actions.

Figure 1 – Six steps of incident investigation

STEP 1 – IMMEDIATE ACTION

In the event of an incident, immediate action to be taken may include making the area safe, preserving the scene and notifying relevant parties. The investigation begins even at this early stage, by collecting perishable evidence, e.g. CCTV tapes, samples.

STEP 2 – PLAN THE INVESTIGATION

Planning ensures that the investigation is systematic and complete. What resources will be required? Who will be involved? How long will the investigation take? For severe or complex incidents, an investigation team will be more effective than a single investigator.

STEP 3 – DATA COLLECTION

Information about the incident is available from numerous sources, not only people involved or witnesses to the event, but also from equipment, documents and the scene of the incident.

STEP 4 – DATA ANALYSIS

Typically, an incident is not just a single event, but a chain of events. The sequence of events needs to be understood before identifying why the incident happened.

When asking why, we need to identify the root and underlying causes, as well as the direct causes. Failures and mistakes don’t just happen by themselves; organisations allow error-enforcing environments that encourage direct causes to develop and persist. Such environments, and the basic management failings behind them, are the root causes – the ultimate source of the incident.

While human error plays a part in the majority of incidents, people are not generally stupid, lazy, forgetful or wilfully negligent. Human errors occur because of influencing factors associated with the work, the environment, an individual’s mental or physical abilities, the organisation and its management systems. Any investigation which sets out to find someone to blame is misguided.

STEP 5 – CORRECTIVE ACTIONS

Many investigations make the mistake of raising actions which deal only with the direct causes – a quick fix, putting last-lines-of- defence back in place. By ignoring the root and underlying causes, not only do they miss an opportunity to reduce the risk of recurrence of the incident, but they also leave open the possibility that other, dissimilar incidents may also occur, arising from the same, common root cause (Fig 2).

Figure 2 – The potential for a single root cause to result in different types of business upset

STEP 6 – REPORTING

The investigation is concluded when all outstanding issues have been closed out and the findings have been communicated so that lessons can be shared. Communication mechanisms include formal incident investigation reports, alerts, presentations and meeting topics.

TOOLS TO HELP

Checklists, proformas and posters can be useful when setting terms of reference, collecting and structuring information, analysing causes, etc. There are also software tools available to help with the entire incident investigation and analysis process, for example TOP-SET Governors’ Investigator3 (see Box 1), and also for recording and tracking incident statistics, their causes and the actions arising from the investigation.

Box 1  – Investigator 3

This article first appeared in RISKworld Issue 14.